Logout Bypass Vulnerability in Hiro.so

How it was found

1. Summary

A logout bypass vulnerability has been identified on platform.hiro.so, allowing users to regain access to their session after logging out simply by pressing the back button on the browser. This issue arises due to improper session invalidation and potential caching misconfigurations. If exploited, this could lead to unauthorized access to sensitive user data, account hijacking risks, and privacy violations.

2. Steps to Reproduce

3. Login to your account on https://platform.hiro.so.

4. Click on Logout to end the session.

5. After logging out, press the back button on the browser.

6. Instead of redirecting to the login page, the previous session remains accessible, allowing the user to navigate through the account as if they never logged out.

Impact

3. Impact

Security Risks:

Unauthorized Account Access – If a user logs out on a shared or public device, the next person can press back and gain full access to the account.

Session Hijacking Risk – If an attacker tricks a user into logging out (via CSRF or social engineering), the victim may assume they are logged out while the attacker retains access.

Privacy Violation – Users expect a logout action to immediately revoke access, but due to improper handling, sensitive information remains accessible.

Real-World Scenarios:

Cyber Café Exploitation: A user logs into their Hiro account on a public computer, logs out, and walks away. The next person presses back and gains full access.

Shared Family Device Risk: A person logs out of their account, but a family member accidentally accesses their session by pressing back.

Attacker Trick: A malicious user could manipulate session handling by logging a victim out forcibly and restoring access later.

4. Root Cause Analysis

Possible Causes:

Session Not Destroyed Properly – If the backend does not terminate the session upon logout, the old session remains valid when accessed via the back button.

5. Conclusion

This logout bypass vulnerability poses a medium-security risk due to improper session handling. Attackers can exploit this flaw on shared devices, leading to unauthorized account access and privacy breaches. Implementing the recommended fixes will enhance security and ensure proper session termination upon logout.

Suggested Next Steps: ✅ Confirm session invalidation on logout. ✅ Apply secure caching policies. ✅ Redirect users when they press the back button.